Hacker News Reader

Comment by fyfy18 | Hacker News Reader

This is my biggest concern about 2FA. On Google I have TOTP 2FA enabled, with my phone number as a backup. But everything goes through my phone - I'm not really worried about some stealing my phone to gain access, but what happens if I break or lose my phone.

A few years ago I was travelling abroad and had my suitcase stolen - which had my laptop (with FDE) and passport inside. Fortunately I had my phone and wallet on me, otherwise I really don't know what I would have done - I probably wouldn't even have remembered the name of the hotel I was staying at that night.

View on HN

Google allows you to print a set of codes [1] that can be used to access your account if your device is lost. I printed a set and have them stored in a secure place at home. Some people keep them in their wallet/bag/similar.

[1] https://support.google.com/accounts/answer/1187538

According to [1]

  Advanced Protection uses a stricter implementation than
  Google has offered in the past: Only those physical 
  keys—along with a password—will unlock your account. If
  you lose them, you can't use a printed out backup code

So, no printed backup codes for Advanced Protection users!

(Presumably your [1] reference is this: https://www.wired.com/story/google-advanced-protection-locks... )

Good point, although I think the parent comment was about Google's existing 2FA rather than the new advanced protection setting.

That's the text making me want a follow-up article.

Yes I have those printed and stored securely, and also my landline set as a backup phone number, but that doesn't really help alleviate my concern of "what happens if I'm abroad and no longer have access to my phone".

I guess keeping the codes with my at all times would work, but doesn't seem like that great an option (paper is easy to lose and easy to destroy). Maybe I should memorize some of them?

When setting up TOTP you can copy the private key (basically the QR code) to a secure storage so you can restore it if your device gets lost or stolen.

However, Google Advanced Protection uses only U2F, not TOTP, so that isn't an option if you're using the advanced protection.

I'm using an alternate OTP app called andOTP that lets you make AES encrypted backups. I save the backup file inside my password manager.

Reply on news.ycombinator.com